EIP-2026-106301

This exploit targets CuteNews 1.4.1 and below, leveraging a path traversal vulnerability to read arbitrary files, specifically the users.db.php file containing hashed passwords. The script sends a crafted HTTP POST request to the target server, bypassing authentication to retrieve sensitive data.